The French Ministry for Europe and Foreign Affairs has officially attributed a series of destructive cyberattacks against the nation’s retail sector to an Iranian state-backed hacking unit. According to the government, the campaign targeted industrial refrigeration controllers at over 700 supermarkets and food-processing facilities during the night of October 11 and 12, 2026. By remotely manipulating defrost settings to reach dangerously high temperatures, the attackers compromised food safety, resulting in the loss of fresh and frozen inventory valued at tens of millions of euros.
French authorities confirmed that the disruption extended beyond food spoilage, noting that the manipulation of these industrial systems sparked at least 15 fires at affected locations. The scope of the incident included major retail chains such as Carrefour, Leclerc, Casino, Intermarché, and Coopérative U, as well as smaller butcher shops and a slaughterhouse. A technical analysis by the French computer emergency response team, CERT-FR, further identified that the same threat actor attempted to compromise Schneider Electric industrial equipment at small-scale hydroelectric installations during the same timeframe, though those attempts resulted in only moderate operational impact.
The French Cyber Crisis Coordination Center, which integrates the national cybersecurity agency ANSSI with military and intelligence branches, identified the perpetrator as the Shahid Kaveh unit, an offensive cyber group affiliated with the Islamic Revolutionary Guard Corps. Investigators linked the group to the attacks through several forensic indicators, including the use of Farsi-language artifacts within the attacker's infrastructure and the utilization of the FOFA search platform for identifying internet-connected industrial devices. Furthermore, the activity was publicized shortly after the event by the propaganda outlet CyberbanNews, which officials have identified as a front for the Shahid Kaveh unit.
While the French government has formally attributed the October supermarket attacks to this Iranian entity, it has not yet linked the same group to a subsequent wave of similar attacks that occurred in November. That later campaign affected more than 115 stores across six European countries. Additionally, the French national blood service reported a separate incident during the same period in which temperature and defrost settings were altered at three facilities responsible for storing blood products. The government has signaled its intent to summon the Iranian ambassador and is pushing for new European Union sanctions against the individuals and organizations involved.
The Shahid Kaveh unit has a documented history of targeting industrial control systems. CERT-FR noted that the group previously claimed responsibility for sabotage operations against U.S. and Israeli interests in early 2026, which included similar attacks on refrigeration equipment. The unit was also observed conducting broad reconnaissance of Schneider Electric systems in France as early as April 2026. These findings align with recent warnings issued by the FBI and CISA, which have alerted organizations worldwide to an ongoing, global threat against cold-chain monitoring systems and industrial refrigeration infrastructure.
The affected parties have confirmed the operational disruption and the resulting material damage, though the full extent of the financial impact remains under investigation. While the French government remains firm in its attribution based on the identified infrastructure and operational patterns, the specific tactics used—such as the exploitation of internet-exposed industrial controllers—reflect a broader, ongoing trend of cyber-sabotage targeting critical infrastructure. As of now, the investigation into the November attacks and the blood service incident remains separate from the confirmed attribution regarding the October retail sector sabotage.
